Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools specifically designed to exploit common web application vulnerabilities (e.g., SQL injection, XSS).

Kitploit recommended

Top tools

10 selected

sqlmap

sqlmapproject/sqlmap

38.2k1 day ago

beef

beefproject/beef

11.0k17h 43m ago

nuclei

projectdiscovery/nuclei

30.4k10h 12m ago

zaproxy

zaproxy/zaproxy

15.6k16h 55m ago

XSStrike

s0md3v/xsstrike

15.1k1 year ago

ffuf

ffuf/ffuf

16.5k1 month ago

dirsearch

maurosoria/dirsearch

14.6k8 days ago

feroxbuster

epi052/feroxbuster

8.0k11 days ago

nikto

sullo/nikto

10.6k2 months ago

#10

wpscan

wpscanteam/wpscan

9.7k7h 54m ago

Newest Relevance Most popular Recently updated

14576 results

adversary_emulation_library

center-for-threat-informed-defense/adversary_emulation_library

An open library of adversary emulation plans designed to empower organizations to test their defenses based on real-world TTPs.

defensive-toolsexploitationweb-application-exploitation+5

2.1k1 year ago

xalgorix

xalgorix/xalgorix

Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.

defensive-toolsreconnaissancevulnerability-scanners+8

1.3k22h 55m ago

ai-exploits

protectai/ai-exploits

A collection of real world AI/ML exploits for responsibly disclosed vulnerabilities

vulnerability-scannersexploit-frameworksweb-application-exploitation+4

1.7k2 years ago

demiguise

nccgroup/demiguise

HTA encryption tool for RedTeams

phishing-toolspayload-generationids-ips-evasion+2

1.4k4 years ago

Gpt-Agreement-Payment

danops-1/gpt-agreement-payment

ChatGPT Plus/Team/Pro 订阅协议端到端重放工具集 · hCaptcha 视觉求解器 · 反欺诈机制实证研究 / End-to-end protocol replay toolkit for ChatGPT Plus/Team/Pro subscription with…

web-application-exploitation

2.2k5 months ago

POC-bomber

tr0uble-maker/poc-bomber

利用大量高威胁poc/exp快速获取目标权限，用于渗透和红队快速打点

vulnerability-scannersexploit-frameworksvulnerability-analysis+4

2.4k3 years ago

SSTImap

vladko312/sstimap

Automatic SSTI detection tool with interactive interface

vulnerability-scannerspayload-generationcode-analysis+6

1.6k2 months ago

exploitgym

sunblaze-ucb/exploitgym

ExploitGym is a large-scale, realistic benchmark built from real-world vulnerabilities designed to evaluate AI agents' ability to develop exploits.

exploit-frameworksvulnerability-analysisshellcode+9

75627 days ago

Nuclei-Templates-Collection

emadshanab/nuclei-templates-collection

Nuclei Templates Collection

vulnerability-scannersweb-vulnerability-scannersweb-application-exploitation+6

1.2k10 months ago

rapidscan

skavngr/rapidscan

:new: The Multi-Tool Web Vulnerability Scanner.

reconnaissancevulnerability-scannersweb-vulnerability-scanners+5

2.1k3 years ago

TIDoS-Framework

0xinfection/tidos-framework

The Offensive Manual Web Application Penetration Testing Framework.

osintreconnaissancevulnerability-scanners+7

1.9k5 years ago

CSPBypass

renniepak/cspbypass

CSPBypass.com, a tool designed to help ethical hackers bypass restrictive Content Security Policies (CSP) and exploit XSS (Cross-Site Scripting)…

vulnerability-analysisweb-application-exploitationconfiguration-auditing+4

70926 days ago

coffeeMiner

arnaucube/coffeeminer

collaborative (mitm) cryptocurrency mining pool in wifi networks

web-application-exploitationpenetration-testingeducation+1

1.1k8 years ago

weaponised-XSS-payloads

hakluke/weaponised-xss-payloads

XSS payloads designed to turn alert(1) into P1

payload-generationexploitationweb-application-exploitation+3

1.4k3 years ago

log4shell-vulnerable-app

christophetd/log4shell-vulnerable-app

Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

payload-generationvulnerability-analysisexploitation+3

1.1k3 years ago

MemShellParty

reajason/memshellparty

一款专注于 Java 主流 Web 中间件的内存马快速生成工具，致力于简化安全研究人员和红队成员的工作流程，提升攻防效率

exploit-frameworkspayload-generationweb-application-exploitation+3

1.6k1 month ago

param-miner

portswigger/param-miner

Burp Suite extension that discovers hidden, unlinked parameters using advanced diffing and binary search, enabling detection of web cache poisoning…

vulnerability-scannersweb-application-exploitationinformation-gathering+1

1.4k2 months ago

LFISuite

d35m0nd142/lfisuite

Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner

vulnerability-scannerspayload-generationexploitation+3

2.0k8 years ago

Previous 1…678…100 Next